Date: Wed, 01 Oct 2003 12:05:29 -0700 From: Micheas Herman <micheas@freep.org> To: Gary <gv-list-freebsdquestions@mygirlfriday.info> Cc: FreeBSD <questions@freebsd.org> Subject: Re: Firewall problem Message-ID: <1065035128.7095.1.camel@tux> In-Reply-To: <20031001181817.21832.qmail@letric.mygirlfriday.info> References: <20031001181817.21832.qmail@letric.mygirlfriday.info>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 2003-10-01 at 11:18, Gary wrote:
> I have set my firewall to
>
> firewall_type="open"
> firewall_enable="YES"
>
> and when I want to drop a specific IP, I enter it manually, it accepts it,
> but it does not drop the packets..
>
> I am getting a lot of virus activity on my SMTP port 25. So I wanted to
> drop a few IP ranges/addresses..
>
> 00100 62054 5483792 allow ip from any to any via lo0
> 00200 0 0 deny ip from any to 127.0.0.0/8
> 00300 0 0 deny ip from 127.0.0.0/8 to any
> 65000 873327 293931424 allow ip from any to any
No rule with a number greater than 65000 will have any effect.
The packet has already passed.
> 65100 0 0 deny tcp from 24.92.226.153 to any
> 65110 0 0 deny ip from 213.191.102.86 to any
> 65535 0 0 deny ip from any to any
Try renumbering the rules in th 64K range.
>
> Yet, checking later in my SMTP logs, I am still getting pounded by the
> listed addresses. Can anyone explain why this isn't working?
>
> Thanks,
--
Micheas Herman <micheas@freep.org>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1065035128.7095.1.camel>